Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers

> A1 — Memory Exhaustion (~383MB):

I'm actually somewhat surprised at the clumsiness here.

I'm a complete amateur that had DeepSeek build a PHP2Shell exploit, and once the stealmybitcoin site went up and set an upload limit, i had DeepSeek try to shrink/amplify it.

DeepSeek couldn't find anything but a 2x reduction, but reading the report of how it was done - https://github.com/KillaBoi/StealMyBitcoin-PoC - I was somewhat surprised it didn't find it, and equally horrified at PHP allowing such a memory bomb of creating nested objects by parsing `f[0][x][x]...` from random requests.

Point being; these aren't amateurs but i kind of expect most well funded pros to have found this method to avoid sending massive filenames and session progress data.

Reading this I'm almost certain the firewall vendor is Palo Alto Networks. They included a PAN-OS setting verbatim and the SELinux config matches my experience.

Dream is btw founded and led by Sebastian Kurz, who was head of the Austrian government. He had to step down because of a corruption scandal.

perhaps i was wrong

https://news.ycombinator.com/item?id=50272530

I am confused. Is this attack possible even after the PHP patches OR these servers just didn't patch ?

With software being fundamentally unsafe I see everything hardwired in chips.

FPGA stocks? DV is about to become hot again..

> Claude Code had been installed

I just do not understand. CC is not the sole harness in the world, why the attackers insist to use it.

It sounds like multiple things were misconfigured on these servers and they still have access?!?

Firewalls are likely fortinet

Now let’s watch the goalposts shift in real time about how severe this vulnerability is.

Haha woopsie

Same here, though what stuck with me is that a firewall's admin PHP page was reachable from the internet at all, keep that on a mgmt VLAN.